ComplianceAsCode / ComplianceAsCode/content

xccdf_org.ssgproject.content_value_var_multiple_time_servers unused

Open
#7,844 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

## Which products and profiles does the rule apply to?

RHEL9

xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server
xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server

Perhaps eventually systemd-datetimed too

## Describe the configuration setting enforced by this rule.

The customization templates include `xccdf_org.ssgproject.content_value_var_multiple_time_servers`, however, this
value doesn't seem to be affecting any rules.

## Why is the configuration security relevant?

The ability to enforce specific trusted timeservers is a benefit to the audit rules.

## How to check the configuration?

Review either the NTPD or chronyd config.

### Is it order dependent? (does it need to be at certain place in the file?)

No

### What is correct and incorrect syntax?

```
pool hotname
```

## How to remediate

Ensure the relevant line/s are in the config.

### Does any command need to be run?

The service may need to be notified about the change to the file.

## Are there going to be other rules like this one in the future? Is it worth creating template? (similar configuration format, similar remediation process...)

Probably since there are similar checks in place for Chrony already.

Having a way to set extra flags like `nts` or other time authentication stuff would be handy.

## Are there any caveats to be considered when testing?

It is specific to the time daemon selected.

## Is the configuration loaded directly by the or is it stored in some intermediate database (similar to dconf)? (We want to edit the lowest level possible, if appropriate)

Text file.

## Is it possible to check / remediate this configuration in offline mode? (scanning containers or offline systems)

This option can be checked in offline mode.

## Please provide security policy references if possible e.g. STIG

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.